Duplicate Content After Deploying an Azure Sentinel Solution

I've been asked this a couple times recently and thought it necessary to expose and highlight. When you deploy an Azure Sentinel solution, it creates the content in the Azure Sentinel environment that's associated with the solution. Things like Analytics Rules, Workbooks, Data Connectors, Parsers, Hunting Queries, etc. that are necessary for the Solution to … Continue reading Duplicate Content After Deploying an Azure Sentinel Solution

How to Get Time Range Help Directly in the Azure Sentinel Console

There's been a mighty effort over the last many months to include helpful links and information directly in the Log Analytics workspace for Azure Monitor - which, thankfully, is also available to Azure Sentinel customers in the Logs blade. A recent update makes getting better information around Time Range syntax quicker and easier, and I'm … Continue reading How to Get Time Range Help Directly in the Azure Sentinel Console

How to Create a Pie Chart Showing Threat Protection Signature Versions

If you'd like to get a sense of the versions for the threat protection signature files that are installed in your environment, here's a quick KQL query to do that. ProtectionStatus | project DeviceName, ThreatStatus, TenantId, ProtectionStatus, SignatureVersion, ScanDate, ProtectionStatusDetails | summarize sig_count=count() by SignatureVersion | render piechart by sig_count This particular KQL query displays … Continue reading How to Create a Pie Chart Showing Threat Protection Signature Versions

How to Send Feedback to the Azure Sentinel Notebook Team

There's a mighty effort underway to ensure that Azure Sentinel customers have as much knowledge and understanding about the Notebooks feature as possible. Azure Sentinel Notebooks is a valuable asset for investigative and hunting analysts alike. There's an introductory blog post available now that is a compliment to the upcoming free training series. See: Becoming … Continue reading How to Send Feedback to the Azure Sentinel Notebook Team

How to Extract the Confidence Score from the Anomali Feeds for Azure Sentinel

There's some good instructions available on how to configure the Anomali feeds for Azure Sentinel. See: https://cda.ms/2sC When you enable and configure the Threat intelligence - TAXII (Preview), data is stored in the ThreatIntelligenceIndicator data table, which includes a ConfidenceScore column. The Anomali feeds contain a confidence score, however, its stowed away in a ThreatType … Continue reading How to Extract the Confidence Score from the Anomali Feeds for Azure Sentinel

Tip: Duplicate and Deprecate to Modify Azure Sentinel Analytics Rules

Just a quick heads-up tip for those that might be affected by this scenario eventually. Some might call this a "best practice" but I know many people hate that term. Hence, my use of the term "tip" instead. When Azure Sentinel Analytics Rules are updated from Microsoft, any changes you have made to the original … Continue reading Tip: Duplicate and Deprecate to Modify Azure Sentinel Analytics Rules

Azure Sentinel Gets Its Own Knowledge Check and Completion Certificate

Following in the footsteps of the rest of the Microsoft security platform tools, Azure Sentinel training now has its own completion certificate! My original post on All the Microsoft Ninja Training I Know About noted that every product except Security Center and Sentinel provided knowledge checks with a resulting completion certificate. But, I've since updated … Continue reading Azure Sentinel Gets Its Own Knowledge Check and Completion Certificate

Azure Sentinel Incident View Column Chooser Reaches GA

Released in Preview in June of this year, the column chooser in the Incident blade of Azure Sentinel is now generally available. You might think this is a pretty low value feature release, but its not. This capability allows analysts to customize the view to show only those areas of content that will be valuable … Continue reading Azure Sentinel Incident View Column Chooser Reaches GA

How to Monitor for ProxyShell Microsoft Exchange Vulnerabilities using Azure Sentinel

Based on recent reporting and evidence its worthwhile to utilize Azure Sentinel to monitor for potential vulnerabilities in ProxyShell for Microsoft Exchange. See: Microsoft Exchange Servers Still Vulnerable to ProxyShell Exploit Here's a quick KQL query to use to Hunt for this vulnerability in your environment. The query can be turned into an Analytics Rule … Continue reading How to Monitor for ProxyShell Microsoft Exchange Vulnerabilities using Azure Sentinel